Actually, the signed hashes tend to only provide a out-of-band chain of accountability. The old Microsoft signed drivers and Application publishers certs were

Actually, the signed hashes tend to only provide a out-of-band chain of accountability. The old Microsoft signed drivers and Application publishers certs were not perfect. This was because the chain of trust eventually breaks down in time (insufficient strength, leaked signing key re-pack, and most people didn't check installer signatures). FOSS projects can also suffer integrity rot on rare occasion, but it tends to be individuals feigning ignorance as their BS is reverted. Archive.org allows one to often search for the CD hash and files of interest in the Wayback Machines snapshot copy of the publishers website. This method does still require the publishers cert or known hash to verify contents are valid. =)